CVE-2025-47783: Label Studio XSS Vulnerability Exploit

CVE-2025-47783 Overview

CVE-2025-47783 is a stored cross-site scripting (XSS) vulnerability in Label Studio, an open-source multi-type data labeling and annotation tool developed by HumanSignal. The flaw affects all versions prior to 1.18.0 and resides in the POST /projects/upload-example/ endpoint handled by label_studio/projects/views.py. An attacker can inject malicious JavaScript into the web page context, enabling session hijacking, data theft, and unauthorized actions performed on behalf of authenticated users. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser of any user viewing crafted project content, leading to account takeover and exfiltration of annotated datasets.

Affected Products

HumanSignal Label Studio versions prior to 1.18.0
Self-hosted Label Studio deployments exposing the /projects/upload-example/ endpoint
Label Studio instances accessible to untrusted or multi-tenant users

Discovery Timeline

2025-05-14 - CVE-2025-47783 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47783

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Label Studio project management workflow. The POST /projects/upload-example/ endpoint accepts user-supplied content that is later rendered in the application UI without adequate output encoding or sanitization. When another authenticated user, including administrators, loads the affected view, the injected script executes in their browser session under the origin of the Label Studio application.

Because the payload persists server-side, exploitation does not require ongoing interaction with the attacker. Any user who navigates to the impacted project resource triggers the payload. This makes the flaw suitable for privilege escalation within multi-user labeling teams and for large-scale credential or token theft.

Root Cause

The root cause is missing input sanitization and output encoding in the request handler defined at label_studio/projects/views.py. User-controlled fields submitted to upload-example are stored and later reflected into HTML contexts without escaping, allowing attacker-controlled markup and script tags to be interpreted as executable code by the browser.

Attack Vector

Exploitation requires network access to the Label Studio web interface and an account able to submit a request to POST /projects/upload-example/. The attacker crafts a request containing an example payload with embedded JavaScript. Victim interaction is required — a legitimate user must load the project page that renders the stored content. Successful exploitation yields access to session cookies, CSRF tokens, and any API actions available to the victim.

No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-8jhr-wpcm-hh4h for vendor technical details.

Detection Methods for CVE-2025-47783

Indicators of Compromise

HTTP requests to POST /projects/upload-example/ containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the request body
Outbound requests from browser sessions to unfamiliar domains shortly after users access Label Studio project pages
Unexpected session or API token usage originating from user accounts that recently viewed shared projects
Modifications to project example data by low-privilege accounts followed by administrator access to the same project

Detection Strategies

Review Label Studio application logs for requests to the /projects/upload-example/ endpoint and flag payloads containing script-like content
Deploy a web application firewall rule to identify HTML and JavaScript patterns in POST bodies targeting the upload endpoint
Enable Content Security Policy (CSP) reporting to capture blocked inline script executions originating from Label Studio pages

Monitoring Recommendations

Correlate authentication events with subsequent administrative API calls to detect session hijacking following project page views
Alert on Label Studio user accounts that upload examples containing raw HTML markup, especially from non-standard IP ranges
Monitor egress traffic from analyst workstations for beaconing patterns immediately after Label Studio activity

How to Mitigate CVE-2025-47783

Immediate Actions Required

Upgrade Label Studio to version 1.18.0 or later, which contains the official patch for CVE-2025-47783
Audit all existing project example data for stored HTML or JavaScript payloads and remove any suspicious content
Rotate session keys and API tokens for users who accessed affected projects prior to patching
Restrict network access to Label Studio instances to trusted users through VPN or identity-aware proxy controls

Patch Information

HumanSignal released the fix in Label Studio version 1.18.0. The patch adds proper sanitization for content processed by label_studio/projects/views.py. Administrators should follow the upgrade guidance in the HumanSignal Security Advisory GHSA-8jhr-wpcm-hh4h.

Workarounds

Limit project creation and example upload permissions to fully trusted administrators until the upgrade is applied
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to the Label Studio origin
Place Label Studio behind a reverse proxy or WAF that filters HTML markup from requests to /projects/upload-example/

bash

# Upgrade Label Studio to the patched release
pip install --upgrade "label-studio>=1.18.0"

# Verify the installed version
label-studio version